Crescio handles sensitive financial data, provider API credentials and authentication secrets. Security reports are taken seriously — thank you for helping keep the project and its self-hosters safe.

Please do not open a public GitHub issue for security problems. Public issues disclose the flaw before a fix is available.

Report privately via GitHub's Private vulnerability reporting: go to the repository's Security tab → Report a vulnerability. This opens a private advisory visible only to you and the maintainers.

Maintainer note: this channel requires Settings → Code security → Private vulnerability reporting to be enabled on the repository.

When reporting, please include:

• A description of the vulnerability and its impact.
• Steps to reproduce or a proof of concept.
• Affected version / commit and deployment details (Docker, bare npm, etc.).

Do not include real credentials, API keys or personal financial data in a report — use redacted or synthetic values, as with regular bug reports (see CONTRIBUTING.md).

Crescio is self-hosted and ships from the latest master / most recent Docker image. Security fixes land on master; there are no separate maintenance branches for older versions.

Please reproduce on an up-to-date checkout before reporting.

The most security-sensitive surfaces, and good places to focus:

• Authentication & sessions — email/password (bcrypt), opaque httpOnly session tokens, TOTP two-factor (lib/auth.ts).
• Credential encryption at rest — provider API keys/secrets and 2FA recovery codes are encrypted with AES-256-GCM, the key derived from AUTH_SECRET via HKDF (lib/crypto.ts).
• The ledger-derived money core — balances, holdings and cost basis are computed from an append-only ledger; correctness bugs that let figures be forged or corrupted are in scope.
• Provider sync — how connected banks, brokerages, exchanges and wallets are fetched and stored.

Crescio is single-tenant and self-hosted. The operator is responsible for:

• Running behind TLS (reverse proxy) with COOKIE_SECURE=true and a correct APP_URL.
• Generating and safeguarding a strong AUTH_SECRET, and keeping it out of version control. Rotating it invalidates all stored provider credentials.
• Securing the host, database and network.

Findings that only apply to an intentionally misconfigured or unpatched deployment are generally not treated as vulnerabilities.

This is a small community project, so response is best-effort rather than SLA-backed. We aim to acknowledge a report, confirm the issue, and work on a fix under coordinated disclosure — please give a reasonable window for a patch before disclosing publicly. Credit is offered to reporters who want it.

Crescio is licensed under the GNU AGPL-3.0.